| Authentication | Proving who you are. In this API, your client proves its identity by presenting a certificate and demonstrating ownership of the matching private key. |
| Authorization | Determining what you're allowed to do once authenticated. Expressed through the scopes attached to your access token. |
| Public/private key pair | Two mathematically linked keys. The private key stays with you and is never transmitted; the public key is shared freely. Anything signed with the private key can be verified with the public key. |
| Private key | The secret half of the key pair. Whoever holds it can act as you, so be sure to follow safekeeping tips. |
| Certificate (X.509) | A document that binds a public key to an identity, signed by a Certificate Authority. Presenting it (together with proof of private key ownership) is how your client authenticates. |
| Certificate Authority (CA) | A trusted party that signs certificates, vouching that the public key inside belongs to the named identity. We act as the CA for API client certificates. |
| Certificate Signing Request (CSR) | A file you generate locally containing your public key, which you submit to the CA. The CA signs it and returns a certificate. Your private key never leaves your machine. |
| mTLS (mutual TLS) | A TLS connection where both sides present certificates. Regular TLS (HTTPS) only authenticates the server; mTLS also authenticates the client. |
| OAuth 2.0 | The industry-standard protocol for authorization. Your client exchanges its credentials for an access token, which it then attaches to API requests. |
| OAuth client | Your application's identity in the authentication layer - how you (and your server) are represented when requesting tokens and accessing the API. |
| Access token | A short-lived credential obtained via OAuth 2.0 and attached to each API request. |
| Certificate-bound access token | In this API, tokens are certificate-bound: they only work over an mTLS connection established with the same certificate used to obtain them. |